CVE-2026-82877
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
ILIAS versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 contain an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ILIAS-eLearning e.V. | ILIAS | 0 < 9.22 | affected |
| ILIAS-eLearning e.V. | ILIAS | 10.0 < 10.10 | affected |
| ILIAS-eLearning e.V. | ILIAS | 11.0 < 11.3 | affected |
Weaknesses
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://github.com/ILIAS-eLearning/ILIAS/commit/e9acd3f8d498279f6c26a145ca32ce85152496a4
- https://github.com/ILIAS-eLearning/ILIAS/blob/v11.2/components/ILIAS/File/classes/class.ilFileXMLParser.php#L244
- https://github.com/ILIAS-eLearning/ILIAS/blob/v11.2/components/ILIAS/soap/classes/class.ilSoapFileAdministration.php#L56
- https://github.com/ILIAS-eLearning/ILIAS
- https://www.vulncheck.com/advisories/ilias-before-9.22-arbitrary-file-read-via-soap-addfile
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.